CVE-2022-50999: Nokogiri before 1.13.5 Integer Overflow via libxml2
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.13.5
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker needs to supply a crafted multi-gigabyte XML file that is processed by the affected Nokogiri installation. No authentication or user interaction is required according to the supplied severity vector.
Which deployments are most exposed?
Deployments using the rubygems/nokogiri package before version 1.13.5 that parse attacker-controlled or otherwise untrusted XML are exposed. The issue is remotely exploitable where an attacker can cause such XML to be processed.
What should be done if upgrading cannot happen immediately?
Prevent untrusted multi-gigabyte XML documents from reaching Nokogiri parsing paths, including by enforcing input-size limits before parsing. This reduces the ability to trigger the vulnerable libxml2 buffer-handling behavior.
What impact should responders consider?
Successful exploitation can cause out-of-bounds memory writes, with potential information disclosure, data modification, or denial of service. Availability impact is rated high, while confidentiality and integrity impacts are rated low in the provided vector.